Back to overview

CVE-2026-28466

CRITICAL
9.9
CVSS 3.1
Description
OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands. Attackers with valid gateway credentials can inject approval control fields to execute arbitrary commands on connected node hosts, potentially compromising developer workstations and CI runners.

Metadata

CVE ID
CVE-2026-28466
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-02-27 19:18 UTC
Published
2026-03-05 21:59 UTC
Last updated
2026-03-09 17:53 UTC
Primary CWE
CWE-863
Incorrect Authorization
Vendor / Product
OpenClaw / OpenClaw
Sources
cve.org  ·  NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
OpenClaw OpenClaw — 0 < 2026.2.14
Weakness (CWE)
CWESourceDescription
CWE-863 cna Incorrect Authorization
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.9 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.4 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References (6)
Back to overview